EUVD-2026-20783
GHSA-pxvw-54xc-72wm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Post Blocks & Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sliderStyle' block attribute in the Posts Slider block in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in Post Blocks & Tools WordPress plugin versions up to 1.3.0 allows authenticated attackers with author-level access to inject arbitrary JavaScript through the 'sliderStyle' block attribute in the Posts Slider block, which executes in the browsers of all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping, enabling persistent payload injection that affects any site administrator or editor visiting a compromised post.
Technical ContextAI
The Post Blocks & Tools plugin (CPE: cpe:2.3:a:pubudu-malalasekara:post_blocks_&_tools:*:*:*:*:*:*:*:*) implements a Posts Slider block that accepts user-supplied attributes including 'sliderStyle' without proper sanitization before output. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a stored/persistent XSS variant. The flaw occurs in the view.php rendering logic where block attributes are echoed directly into the DOM without escaping HTML special characters or using WordPress's esc_attr() or esc_html() functions. Since this is a Gutenberg block attribute, the injection occurs during block registration and content rendering, affecting the server-side rendering pipeline rather than client-side JavaScript execution.
RemediationAI
Update the Post Blocks & Tools plugin to version 1.3.1 or later immediately. The patched version is available in the WordPress plugin repository and can be updated via the WordPress admin dashboard (Plugins > Installed Plugins > Post Blocks & Tools > Update) or via WP-CLI (wp plugin update post-blocks-and-tools). Site administrators should review recent posts and pages edited by author-level accounts for suspicious slider blocks with malicious styling attributes. For sites unable to immediately patch, temporarily deactivate the plugin or restrict author-level capabilities until the update is deployed. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/aeada6dc-0851-45e8-ada9-ff0427b7f17a?source=cve and the WordPress plugin repository changeset for implementation details.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today